Action & Static Security Scanning¶

This repository employs continuous, proactive security scanning using Trivy and Zizmor.

🔍 Scanner Tools¶

1. Zizmor (GitHub Actions Security Auditor)¶

Zizmor is a specialized static analysis tool for GitHub Actions workflows and composite actions. It detects common CI/CD security risks, including:

• Unpinned Action References: Third-party actions referenced by mutable tags (e.g. @v1) instead of immutable commit SHAs.
• Template Injection: Insecure interpolation of untrusted inputs (e.g., ${{ github.event.issue.title }}) in bash scripts.
• Secrets Leakage: Inadvertent printing or logging of sensitive tokens.
• Overprivileged Tokens: Workflows running with excessive default GITHUB_TOKEN permissions.

Run Zizmor locally:

mise run scan
# or directly:
zizmor .

2. Trivy (Filesystem Vulnerability Scanner)¶

Trivy scans repository files and dependencies for known CVEs and misconfigurations:

trivy fs --format table --severity HIGH,CRITICAL .

⚡ Pre-Commit Hook Integration¶

Both scanners run automatically before code is committed via .pre-commit-config.yaml:

  - repo: https://github.com/woodruffw/zizmor-pre-commit
    rev: v1.4.1
    hooks:
      - id: zizmor